On (2007-04-24 23:59 +0200), Gert Doering wrote: > > Even if it would be supported, wouldn't it still mean that all packets > > source-route packets reach MSFC. And while it would stop this feature > > from working, it would still leave the DoS vector open? > > That's what we have hardware rate limiters for... :)
I don't believe PFC3 supports CoPP or IPv6 unicast mls rate-limiters. So you'd end up having ACL in each interface, and I'm not sure if ACL's have proper lookups either to handle this, and even if they do, you probably would need to run in compressed address mode. I doubt many are going to do that, except perhaps in AS borders. -- ++ytti _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
